v0.108.0: hub-verified escrow auto-confirm on current-password hash match (SLICE 3)

EscrowAutoConfirmer flips pending->escrowed ONLY when sha256(local repo
password) matches the ACK's restic_pw_sha256 (blob-presence alone never
confirms — red-proofed). Mismatch warns once per hash naming the ceremony;
never un-confirms; wipes the staged secret on flip. Pinned cross-repo hash
vector; manual confirm deprecated to a legacy-blob fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/web/offbox_handlers.go

@@ -108,10 +108,11 @@ func (s *Server) offboxConfigHandler(w http.ResponseWriter, r *http.Request) {
 	offboxRedirect(w, r, "A NAS mentési cél elmentve."+stageErr, stageErr != "")
 }
 
-// offboxConfirmEscrowHandler marks the offsite repo password as escrowed under R (fork-4). The operator
-// calls this after a successful escrow-create ceremony; offsite runs stay gated until then. (The
-// provisioning task should replace this with a hub-verified auto-confirm to remove the operator-forgets/
-// operator-lies footgun.)
+// offboxConfirmEscrowHandler marks the offsite repo password as escrowed under R (fork-4).
+// DEPRECATED FALLBACK (SLICE 3): the PRIMARY path is the hub-verified auto-confirm
+// (report.EscrowAutoConfirmer — flips on a hash match in the report ACK, no operator involved). This
+// manual endpoint stays for LEGACY blobs recorded before the hash existed (e.g. the demo's) — they have
+// no restic_pw_sha256 and can never auto-confirm; the operator vouches by hand after a verified ceremony.
 func (s *Server) offboxConfirmEscrowHandler(w http.ResponseWriter, r *http.Request) {
 	if s.backupMgr == nil || !s.backupMgr.OffboxConfigured() {
 		offboxRedirect(w, r, "A NAS mentési cél nincs beállítva.", true)